Unable to handle kernel paging request at virtual address dfff800000000031 KASAN: null-ptr-deref in range [0x0000000000000188-0x000000000000018f] Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault Data abort info: ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0 [dfff800000000031] address between user and kernel address ranges Internal error: Oops: 0000000096000005 [#1] SMP Modules linked in: CPU: 0 UID: 0 PID: 4937 Comm: syz.0.17 Tainted: G M syzkaller #0 PREEMPT Tainted: [M]=MACHINE_CHECK Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 pstate: 034000c5 (nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : blk_mq_complete_request_remote+0xc4/0x858 block/blk-mq.c:1310 lr : blk_mq_complete_request_remote+0x88/0x858 block/blk-mq.c:1302 sp : ffff80008f7e7ba0 x29: ffff80008f7e7c30 x28: ffff80008f7e7ba0 x27: 1fffe0001912ba1c x26: 0000000000000001 x25: ffff0000c895d0ee x24: dfff800000000000 x23: ffff700011efcf74 x22: 1fffe00019163724 x21: ffff0000c8b1b924 x20: 000000000000018e x19: ffff0000c8b1b800 x18: 0000000000000000 x17: ffff80011b876000 x16: ffff80008f7e0000 x15: 0000000000000000 x14: 0000000000634400 x13: 0000000000000005 x12: 0000000000000000 x11: ffff80008f7e7d98 x10: ffff80008840a4c8 x9 : 1fffe00019163702 x8 : 0000000000000031 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffff8000827ef2a0 x2 : 0000000000000000 x1 : ffff0000d064d880 x0 : 0000000000000000 Call trace: blk_mq_complete_request_remote+0xc4/0x858 block/blk-mq.c:1310 (P) nvme_try_complete_req drivers/nvme/host/nvme.h:839 [inline] nvme_handle_cqe drivers/nvme/host/pci.c:1601 [inline] nvme_poll_cq+0x544/0xfd8 drivers/nvme/host/pci.c:1632 nvme_irq+0x9c/0x120 drivers/nvme/host/pci.c:1646 __handle_irq_event_percpu+0x200/0x8ac kernel/irq/handle.c:209 handle_irq_event_percpu+0x2c/0xd8 kernel/irq/handle.c:246 handle_irq_event+0x98/0x188 kernel/irq/handle.c:263 handle_fasteoi_irq+0x328/0x864 kernel/irq/chip.c:768 generic_handle_irq_desc include/linux/irqdesc.h:188 [inline] handle_irq_desc kernel/irq/irqdesc.c:679 [inline] generic_handle_domain_irq+0xe4/0x154 kernel/irq/irqdesc.c:735 __gic_handle_irq drivers/irqchip/irq-gic-v3.c:825 [inline] __gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:873 [inline] gic_handle_irq+0x6c/0x180 drivers/irqchip/irq-gic-v3.c:917 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901 do_interrupt_handler+0xd4/0x138 arch/arm64/kernel/entry-common.c:216 __el1_irq arch/arm64/kernel/entry-common.c:568 [inline] el1_interrupt+0x3c/0x60 arch/arm64/kernel/entry-common.c:581 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:586 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:602 write_comp_data+0x74/0x84 kernel/kcov.c:268 (P) __sanitizer_cov_trace_const_cmp8+0x24/0x30 kernel/kcov.c:317 access_ok arch/arm64/include/asm/uaccess.h:46 [inline] user_access_begin arch/arm64/include/asm/uaccess.h:416 [inline] futex_get_value_locked kernel/futex/futex.h:305 [inline] futex_wait_setup+0x174/0x674 kernel/futex/waitwake.c:659 __futex_wait+0x108/0x25c kernel/futex/waitwake.c:717 futex_wait+0x108/0x2c0 kernel/futex/waitwake.c:750 do_futex+0x320/0x378 kernel/futex/syscalls.c:133 __do_sys_futex kernel/futex/syscalls.c:210 [inline] __se_sys_futex kernel/futex/syscalls.c:191 [inline] __arm64_sys_futex+0x2e4/0x418 kernel/futex/syscalls.c:191 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:796 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606 Code: 97d03f93 f9400288 91063914 d343fe88 (38f86908) ---[ end trace 0000000000000000 ]--- Calling EFI runtime from hardirq context Calling EFI runtime from hardirq context Calling EFI runtime from hardirq context Calling EFI runtime from hardirq context Calling EFI runtime from hardirq context Calling EFI runtime from hardirq context Calling EFI runtime from hardirq context Calling EFI runtime from hardirq context Calling EFI runtime from hardirq context Calling EFI runtime from hardirq context ---------------- Code disassembly (best guess): 0: 97d03f93 bl 0xffffffffff40fe4c 4: f9400288 ldr x8, [x20] 8: 91063914 add x20, x8, #0x18e c: d343fe88 lsr x8, x20, #3 * 10: 38f86908 ldrsb w8, [x8, x24] <-- trapping instruction